feat(channels): 非消息事件接入（notice 归一化 + 传入前审查，fail-safe 静默）与入站脱敏帧日志/日志轮转

- notice：adapter 归一化 seam + 结构化分类 + 净化（ANSI/控制/零宽/双向字符、200 runes 截断）
  + fail-safe 写死为「静默」（未装配审查/超时/失败 ⇒ 仅登记、不驱动 loop）
- 身份面零改动：notice 发送者恒 RoleSystem + SenderID=system
- 复用策略四的同一个审查模型（Options.Review），未另造第二套
- 入站帧脱敏 DEBUG（post_type/message_type/sub_type/self_id/user_id/sender_id/group_id/段类型/at 目标）
- ctrl.bat 启动前归档轮转（保留 20 份）+ bash 侧改追加（不再重启即截断）

scripts/ctrl.bat

@@ -16,6 +16,10 @@ rem    - single binary, run from the repo root (reads .env PORT / DATA_DIR ...)
 rem    - port comes from .env PORT, falls back to 10080
 rem    - log: %USERPROFILE%\cy.log (app logs to stderr);
 rem      stdout fallback: %USERPROFILE%\cy.stdout.log
+rem    - the previous run's logs are NEVER discarded: before each start they are
+rem      archived as <name>.<yyyyMMdd-HHmmss>.bak, newest %LOG_KEEP% kept. Needed
+rem      because Start-Process -RedirectStandard* OVERWRITES its target (PowerShell
+rem      has no append form), so every restart used to wipe the evidence in cy.log.
 rem    - pid file: %USERPROFILE%\.cyrene.pid, else detected from the port
 rem    - Start-Process -WindowStyle Hidden = detached start
 rem      (the ctrl.sh equivalent of "setsid nohup ... & disown")
@@ -41,6 +45,8 @@ if not exist "%APP_BIN%" set "APP_BIN=%USERPROFILE%\apps\cyrene\cyrene.exe"
 set "PID_FILE=%USERPROFILE%\.cyrene.pid"
 set "LOG_FILE=%USERPROFILE%\cy.log"
 set "STDOUT_FILE=%USERPROFILE%\cy.stdout.log"
+rem LOG_KEEP: how many archived logs to retain (one per start, oldest pruned first)
+set "LOG_KEEP=20"
 
 rem ---- port: .env PORT wins, fallback 10080 ----
 set "GW_PORT="
@@ -99,6 +105,7 @@ if not exist "%APP_BIN%" (
 )
 echo Starting cyrene -^> %APP_BIN%  ^(port %GW_PORT%^)
 cd /d "%REPO%" || exit /b 1
+call :rotate_logs
 powershell -NoProfile -Command "Start-Process -FilePath '%APP_BIN%' -WorkingDirectory '%REPO%' -RedirectStandardOutput '%STDOUT_FILE%' -RedirectStandardError '%LOG_FILE%' -WindowStyle Hidden"
 set /a TRIES=0
 :start_wait
@@ -222,3 +229,30 @@ if defined PORT_PID (
   >"%PID_FILE%" echo !PORT_PID!
 )
 exit /b 0
+
+rem rotate_logs: keep the previous run's log instead of letting it be overwritten.
+rem Start-Process -RedirectStandardOutput/-RedirectStandardError OVERWRITE their
+rem target (PowerShell has no append form), so without this every restart wiped
+rem cy.log -- i.e. each restart destroyed the evidence of the run before it.
+rem Archiving (not appending) also keeps the runs separable. Failures are ignored
+rem on purpose: a log we cannot archive must never block a start.
+:rotate_logs
+set "RUN_TS="
+for /f "usebackq delims=" %%T in (`powershell -NoProfile -Command "Get-Date -Format yyyyMMdd-HHmmss"`) do if not defined RUN_TS set "RUN_TS=%%T"
+if not defined RUN_TS set "RUN_TS=unknown%RANDOM%"
+if exist "%LOG_FILE%" move /y "%LOG_FILE%" "%LOG_FILE%.%RUN_TS%.bak" >nul 2>&1
+if exist "%STDOUT_FILE%" move /y "%STDOUT_FILE%" "%STDOUT_FILE%.%RUN_TS%.bak" >nul 2>&1
+call :prune_logs "%LOG_FILE%"
+call :prune_logs "%STDOUT_FILE%"
+exit /b 0
+
+rem prune_logs <base>: keep only the newest %LOG_KEEP% archives of <base>.
+rem Runs with %USERPROFILE% as the working directory so the bare names dir prints
+rem resolve (the repo may sit on another drive than %USERPROFILE%; pushd/popd then
+rem echo the directory, hence the >nul).
+:prune_logs
+set "PRUNE_BASE=%~1"
+pushd "%USERPROFILE%" >nul 2>&1 || exit /b 0
+for /f "skip=%LOG_KEEP% delims=" %%F in ('dir /b /o-d /a-d "%PRUNE_BASE%.*.bak" 2^>nul') do del /q "%%~F" >nul 2>&1
+popd >nul 2>&1
+exit /b 0